diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 66721ca..709eada 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -189,7 +189,7 @@ jobs:
       # openapi-generator runs via `pnpm dlx` (pnpm is set up above) but is a
       # Java program, so a JDK must be on PATH. Dart runs build_runner, format,
       # analyze and the publish dry run.
-      - uses: actions/setup-java@v5.7.0
+      - uses: actions/setup-java@v6.0.0
         with:
           distribution: temurin
           java-version: "21"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ccae425..e088f38 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -122,7 +122,7 @@ jobs:
 
       - name: Select mode
         id: select-mode
-        uses: changesets/action/select-mode@c47fa68bd43bb8ae0bae7e558622593deebf5955 # v2.0.0-next.3
+        uses: changesets/action/select-mode@8488615a623b1b9c987934bb89eae8af6a946ac1 # v2.0.0-next.3
 
   # Pending changesets exist → open or refresh the version pull request.
   #
@@ -160,7 +160,7 @@ jobs:
       # its stamped pubspec. That runs openapi-generator via `pnpm dlx` and then
       # build_runner, which needs a JDK on PATH and Dart; dlx fetches and
       # version-pins the generator itself, so nothing else installs.
-      - uses: actions/setup-java@v5.7.0
+      - uses: actions/setup-java@v6.0.0
         with:
           distribution: temurin
           java-version: "21"
@@ -181,7 +181,7 @@ jobs:
           permission-pull-requests: write # open/update the version PR
 
       - name: Create or update the version pull request
-        uses: changesets/action/version@c47fa68bd43bb8ae0bae7e558622593deebf5955 # v2.0.0-next.3
+        uses: changesets/action/version@8488615a623b1b9c987934bb89eae8af6a946ac1 # v2.0.0-next.3
         with:
           github-token: ${{ steps.app-token.outputs.token }}
           # `changeset version` then regenerate, so the Dart pubspec's version
@@ -226,7 +226,7 @@ jobs:
 
       - name: Pack
         id: pack
-        uses: changesets/action/pack@c47fa68bd43bb8ae0bae7e558622593deebf5955 # v2.0.0-next.3
+        uses: changesets/action/pack@8488615a623b1b9c987934bb89eae8af6a946ac1 # v2.0.0-next.3
         with:
           publish-plan-artifact-id: ${{ needs.select-mode.outputs.publish-plan-artifact-id }}
 
@@ -285,7 +285,7 @@ jobs:
       # PUBLIC; npm refuses to sign provenance from a private source repo.
       - name: Publish to npm
         id: changesets
-        uses: changesets/action/publish@c47fa68bd43bb8ae0bae7e558622593deebf5955 # v2.0.0-next.3
+        uses: changesets/action/publish@8488615a623b1b9c987934bb89eae8af6a946ac1 # v2.0.0-next.3
         with:
           github-token: ${{ steps.app-token.outputs.token }}
           pack-dir-artifact-id: ${{ needs.pack.outputs.pack-dir-artifact-id }}